I wish there was more interest in bringing new things like this to the ReMarkable 2. There are some projects, but they are not great, and mostly I just want to get a good book-reading experience. Maybe I should try it myself, or well, have Claude try.
Very nice! I'll play with it for a few days and see how I like it. However:
3. Korren isn't in the Brewfile — build it from the korren repo:
./packaging/macos/build-app.sh --install
What korren repo? it doesn't even exist under your github user anymore...
hahaha nice catch thats an easter egg or sneak peak. Its not required and the piece in the install script is just for me atm to integrate it with the theming so it stays consistent with the omacosy theme. It does nothing if korren is not installed. That readme section just shows how you can configure your default terminal and browser for the shortcuts. Korren is a GPU-accelerated terminal emulator with workspaces, tabs and splits with command blocks that I am still working on and plan to open source soon.
I just realized it was putting in the config file even if korren is not installed, thanks for the hint I fixed that with a guard. Its harmless but useless clutter.
Afaik there's no language - the pseudocode can be written however you want. And the costing money to compile? If you're prompting an llm you're already doing that, just with prose instead of pseudocode. I'm not sure this approach is a good idea, but it might be - and imo it's worth trying :)
Yes exactly. Except now, the language has zero constraints. It can be a perfect distillation of your intentions.
You might think, well code is perfect. But code is syntactically perfect, because it has to be. Because compilers can handle very little ambiguity. But that doesn't mean it's a perfect representation of your thoughts. A huge part of language design is for the compiler, not for the author.
And I'm not 100% sure of this, but I'm fairly confident that this approach would be far more token efficient than the way we currently use AI for programming.
I could do this before too. The way I work is that I just write some functions, fully annotated, in whatever language the project is in, with a comment on what I expect the code to do, and an empty return. Then get an LLM to fill in the functions.
Helps me think about the problem, like your post mentioned, but I don't have to pay a tax on converting a prototyping language to a different language.
This is how I liked to write software pre-LLM. Top down. Write the interface and tests first, implementation second. I think I got it from SICP. "Wish-driven programming" I think I heard once.
That’s exactly what this editor is for, except that your original written version is retained and source-mapped to the code that it generated. So as a project grows in size and complexity, you have a smaller foot print of human-written intent that acts as a reference. There’s no “prototyping language”, it’s just whatever you want to write.
Basically yes that’s what I’m proposing. Not sure if I’d describe it as a loop though - more like returning to some midway point after having traveled too far in one direction.
Fully manual coding is the most reliable but extremely slow and costly.
Fully LLM driven coding is extremely fast, but for serious work is too unreliable.
Spec-driven development might be viable, but too often the specs end up being LLM maintained, which defeats the purpose.
You need some hard boundary in the codebase where only human hands touch the files. And you want to enable the velocity that AI allows. So yes, semi-formal programming does seem like a promising solution.
I went back to 15 after accidentally upgrading to 26 because on MBA 13" screen the new UI design uses a lot of extra padding everywhere wasting screen space which is already at a premium (especially vertical). Hoping 27 fixes a lot of these issues.
Asahi is a very cool project, and worthwhile if someone goes into it well aware of the major tradeoffs they're making, including reduced hardware functionality and support, which is improving, and significantly degraded security, which will likely always be the case.
It would be completely unreasonable for me to suggest such a thing. You can tell that I didn't because I would have written "all tradeoffs," not "major tradeoffs," before I provided a grand total of two tradeoffs in a single sentence. I don't know how one could arrive at that conclusion.
"So install Asahi Linux?" lacks substance. While I'm sure some four-word responses can contain a great deal of substance, this one didn't. Stating even a single tradeoff or implication of your suggestion would have been one way to have contributed something of substance. There are other ways, of course. You reached for none of them in that comment.
A substantive comment really shouldn't resemble something which could be achieved via a small set of macros.
Shallow promotion also runs the very real risk of turning people off of what you're promoting, and I actually agree with you on the value of some of your favorite software projects (even if our reasons may not fully align). In both positive and negative forms, a shallow one-liner may cause others to take the few seconds you didn't to add basic context which could prevent casual observers from being potentially misled or misinformed, or from taking a needlessly dim view of something due to consistently deficient messaging.
If you write Qt applications, Qt Creator is perfectly usable and as it's cross-platform you only need to be familiar with one IDE. It ships with its own deploy command which packages the app. You still need to run code signing/notarization last time I checked, but if the complaint is the XCode GUI then no problem there.
It seems too concise to be AI. My (conscious) heuristic for AI writing is how much context is squeezed into a sentence. LLMs seem to be pretty bad at the kind of elegant compression of meaning humans can do when they have done a lot of writing practice.
If I had to guess, I would say this is the human summarised conversation(s) with a bot.
Sorry if my speculation was bad! When I wrote it I meant it as a compliment. Raw LLM output is awful and really needs a human to "translate" the useful content to something worth reading.
And that’s not true! He did want to keep the editor stable and available for many platforms and compatible with vi. Rejected proposals break one of these rules.
One of these days I'm gonna have to learn why cross-site scripting even matters, especially with modern browsers restricting a script's access to anything local
The "Hello world" examples always show using it to steal your cookies, which obviously doesn't work now when nearly every site uses the "httpOnly" flag which makes the cookie inaccessible to JavaScript, but really, stealing your session isn't necessary. They just have to make the XSS payload run the necessary JavaScript.
Once the JavaScript is running on the page, all bets are off. They can do ANYTHING that the page can do, because now they can make HTTP requests on your behalf. SOP no longer applies. CSRF no longer protects you. The attacker has full control of your account, and all the requests will appear to come from YOUR browser.
If I can run my own code but in your context, I can pull in malicious scripts.
With those (all these are "possible" but not always, as usual, it depends, and random off the top of my head):
- I can redirect you to sites I control where I may be able to capture your login credentials.
- May be able to prompt and get you to download malware or virus payloads and run them locally.
- Can deface the site you are on, either leading to reputational harm for that brand, or leading you to think you're doing one thing when you're actually doing another.
- I may be able to exfiltrate your cookies and auth tokens for that site and potentially act as you.
- I might be able to pivot to other connected sites that use that site's authentication.
- I can prompt, as the site, for escalated access, and you may grant it because you trust that site, thereby potentially gaining access to your machine (it's not that the browsers fully restrict local access, they just require permission).
- Other social engineering attacks, trying to trick you into doing something that grants me more access, information, etc.
It's a good question and one mature orgs ask themselves all the time. As you can see from most of the replies here, XSS captures the fancy of the bug bounty crowd because there are tonnes of hypothetical impacts so everyone is free to let their imagination run wild when arguing with triagers. It's also the exploit nonpareil for nerdsnipers because sanitisation is always changing and people get to spend their days coming up with increasingly ridiculous payloads to bypass them. In reality, find me one active threat actor who has compromised a business lately with an XSS. It's not an irrelevant risk, but the attention it gets is wildly disproportionate to its real-world impact.
